Apple Chips Can Be Hacked To Leak Secrets From Gmail, ICloud, and More (arstechnica.com) 27
An anonymous reader quotes a report from Ars Technica: Apple-designed chips powering Macs, iPhones, and iPads contain two newly discovered vulnerabilities that leak credit card information, locations, and other sensitive data from the Chrome and Safari browsers as they visit sites such as iCloud Calendar, Google Maps, and Proton Mail. The vulnerabilities, affecting the CPUs in later generations of Apple A- and M-series chip sets, open them to side channel attacks, a class of exploit that infers secrets by measuring manifestations such as timing, sound, and power consumption. Both side channels are the result of the chips' use of speculative execution, a performance optimization that improves speed by predicting the control flow the CPUs should take and following that path, rather than the instruction order in the program. [...]
The researchers published a list of mitigations they believe will address the vulnerabilities allowing both the FLOP and SLAP attacks. They said that Apple officials have indicated privately to them that they plan to release patches. In an email, an Apple representative declined to say if any such plans exist. "We want to thank the researchers for their collaboration as this proof of concept advances our understanding of these types of threats," the spokesperson wrote. "Based on our analysis, we do not believe this issue poses an immediate risk to our users." FLOP, short for Faulty Load Operation Predictor, exploits a vulnerability in the Load Value Predictor (LVP) found in Apple's A- and M-series chipsets. By inducing the LVP to predict incorrect memory values during speculative execution, attackers can access sensitive information such as location history, email content, calendar events, and credit card details. This attack works on both Safari and Chrome browsers and affects devices including Macs (2022 onward), iPads, and iPhones (September 2021 onward). FLOP requires the victim to interact with an attacker's page while logged into sensitive websites, making it highly dangerous due to its broad data access capabilities.
SLAP, on the other hand, stands for Speculative Load Address Predictor and targets the Load Address Predictor (LAP) in Apple silicon, exploiting its ability to predict memory locations. By forcing LAP to mispredict, attackers can access sensitive data from other browser tabs, such as Gmail content, Amazon purchase details, and Reddit comments. Unlike FLOP, SLAP is limited to Safari and can only read memory strings adjacent to the attacker's own data. It affects the same range of devices as FLOP but is less severe due to its narrower scope and browser-specific nature. SLAP demonstrates how speculative execution can compromise browser process isolation.
The researchers published a list of mitigations they believe will address the vulnerabilities allowing both the FLOP and SLAP attacks. They said that Apple officials have indicated privately to them that they plan to release patches. In an email, an Apple representative declined to say if any such plans exist. "We want to thank the researchers for their collaboration as this proof of concept advances our understanding of these types of threats," the spokesperson wrote. "Based on our analysis, we do not believe this issue poses an immediate risk to our users." FLOP, short for Faulty Load Operation Predictor, exploits a vulnerability in the Load Value Predictor (LVP) found in Apple's A- and M-series chipsets. By inducing the LVP to predict incorrect memory values during speculative execution, attackers can access sensitive information such as location history, email content, calendar events, and credit card details. This attack works on both Safari and Chrome browsers and affects devices including Macs (2022 onward), iPads, and iPhones (September 2021 onward). FLOP requires the victim to interact with an attacker's page while logged into sensitive websites, making it highly dangerous due to its broad data access capabilities.
SLAP, on the other hand, stands for Speculative Load Address Predictor and targets the Load Address Predictor (LAP) in Apple silicon, exploiting its ability to predict memory locations. By forcing LAP to mispredict, attackers can access sensitive data from other browser tabs, such as Gmail content, Amazon purchase details, and Reddit comments. Unlike FLOP, SLAP is limited to Safari and can only read memory strings adjacent to the attacker's own data. It affects the same range of devices as FLOP but is less severe due to its narrower scope and browser-specific nature. SLAP demonstrates how speculative execution can compromise browser process isolation.
Well that's not good (Score:1)
I guess I'll hang on to my 2019 Intel-architecture Macbook Pro for a while longer, then.
And I wanted to run AI models on my laptop. Bummer.
Re: (Score:2)
I guess I'll hang on to my 2019 Intel-architecture Macbook Pro for a while longer, then.
Uh, lol.
I've got bad news for you if you're looking to dodge speculative execution side channels that way... Particularly since I don't think they're still updating those?
Re:Well that's not good (Score:4, Informative)
Except Intel fucked this up first, and apparently Apple didn't learn anything from their fuckup and did basically the same shit.
Re: (Score:2)
Except Intel fucked this up first, and apparently Apple didn't learn anything from their fuckup and did basically the same shit.
I was hoping I might somehow have mod points to give you for this, but maybe others who do will mod you up.
Re:Well that's not good (Score:5, Insightful)
Speculative side channels are a pandora's box. You aren't closing it.
Every CPU made going forward is going to be vulnerable to these things, and people will keep finding them, and we will keep fixing them.
Re:Well that's not good (Score:4, Informative)
Speculative side channels are a pandora's box. You aren't closing it.
Every CPU made going forward is going to be vulnerable to these things, and people will keep finding them, and we will keep fixing them.
And no one is going to spend the time and expense to use formal methods to prove that the speculative execution mechanisms are secure.
Being honest here. I think they could do it with formal methods, but time to market will win out.
Re: (Score:2)
Re: (Score:2)
Formal methods still depend on a specification that covers the entire space you want to verify. The divider that resulted in the FDIV bug was formally verified; it was just verified against a specification that was wrong.
Re:Well that's not good (Score:4, Informative)
I haven't looked at the detail of Apple's flaw, but in Intel's case it was a conscious decision not to roll back everything that was done speculatively, to improve performance. They thought that what was leaking was not important. AMD did it properly, so while there have been some issues around their speculative execution technology, they have been far less severe and the mitigations haven't had a devastating effect on performance.
Re: (Score:2)
but in Intel's case it was a conscious decision not to roll back everything that was done speculatively, to improve performance
In which Intel's case? Both Intel and AMD parts have been vulnerable to literally dozens of speculative side channel attacks, now.
Some were accidents, some were deliberate decisions- all were predicated upon what was considered an impossibility- that someone could probe state without direct access to it. That assumption was wrong, and I don't consider any decisions made before the discovery otherwise as erroneous.
They thought that what was leaking was not important. AMD did it properly, so while there have been some issues around their speculative execution technology, they have been far less severe and the mitigations haven't had a devastating effect on performance.
This is absurd.
RETBLEED was literally caused by them trying to say their RETPOLINE worked, wh
Re: (Score:2)
I haven't looked at the detail of Apple's flaw, but in Intel's case it was a conscious decision not to roll back everything that was done speculatively, to improve performance. They thought that what was leaking was not important. AMD did it properly, so while there have been some issues around their speculative execution technology, they have been far less severe and the mitigations haven't had a devastating effect on performance.
The processor did roll everything back, or that's not how information was leaked anyway.
It was like there's a mystery box with a name in it at a party you crashed. You ask hey is Bill around? They look around and say who the hell is Bill? Oh forget it.
Can you tell whosever's box this is to go move their car? They peek in the box and eye the room, "No, you're a stranger." They think you want the box.
You bore them to death with a very long story to reset their memory.
Hey is Charlie around? Someone glances aro
Re: (Score:2)
"They thought that what was leaking was not important."
Show us where you had identified evicting unprivileged data from a cache as a leak that predates the flaw in question.
They didn't think leaking was unimportant; they thought they weren't leaking anything.
Kill -9 (Score:2)
Except Intel fucked this up first, and apparently Apple didn't learn anything from their fuckup and did basically the same shit.
This was the criticism the US Nuclear Submarine program had of NASA when they boasted of the Columbia accident "No one operates high performance machinery in extreme environments the way we do". Their response was "We put 5000 personnel into studying the Challenger disaster and improving our processes - how many did you allocate?".
The lessons the Submarine program have to teach IT about developing cutting edge technology come from listening to dissenting opinion. Signs of agreement usually meant that a t
Re: (Score:2)
Apple has already said they'll patch the issue shortly and there's no evidence it's been exploited in the wild.
Re: (Score:2)
The worst part of this speculative execution side-channel hell is that it causes a degradation of performance over time as they're found and fixed. It contributes to premature hardware obsolescence.
Re: (Score:2)
Re: (Score:2)
Aim? (Score:4, Insightful)
Re: (Score:2)
Re: (Score:3)
Re: (Score:2)
Re: (Score:2)
I've wondered the same thing myself, but after thinking about it more I realized how valuable this attack could be. Governments around the world would have the ability to attack public services hosted on cloud servers and extract keys and passwords to accounts with extremely valuable information. With that in mind, we have to assume they're dedicating tons of resources to exploiting this and that they've already gotten much further along than
About to buy an M4.. (Score:2)
Welp, at least they'll patch it. Hopefully that sticks.. these speculation flaws seem to be tough to address. ;) But tbh if I am just say running a local LLM and not surfing the web it would be nice if we could turn off for specific apps a fix that drops 10% of its performance. Just sayin'.
New OS update out now.... (Score:2)
Potato chips dont have this problem (Score:4, Funny)
Taste better too.
How Do We Not Have Secure Memory? (Score:2)